Security at TAIA
TAIA GmbH builds TAIA Confidential Screening and TAIA Confidential Ask. This page says how the Screening protocol works, how to report a security problem to us, and what we promise in return. It is not a certification and no outside review has been made yet; see the terms of each service.
How TAIA Confidential Screening works. The protocol specification and threat model are published here: TAIA Confidential Screening: protocol specification and threat model, v0.1, 1 November 2026 (Markdown) (© 2026 TAIA GmbH, licensed under CC BY 4.0). Test vectors and the script that reproduces them: case-1-match-all.answer.bin, case-1-match-all.query.bin, case-1-match-all.secret-key.bin, case-2-match-some.answer.bin, case-2-match-some.query.bin, case-2-match-some.secret-key.bin, case-3-no-match.answer.bin, case-3-no-match.query.bin, case-3-no-match.secret-key.bin, vectors.json, make-vectors.mjs, SHA256SUMS (MIT License; they use Microsoft SEAL and node-seal, both MIT). The specification describes TAIA's own protocol; it is not a standard and has not had an outside cryptography review.
Reporting a security problem. Write to info@taia.ch (this address is also in our security.txt). Tell us what you found, how to reproduce it, and how we can reach you. Encrypted mail is not offered; please do not send secrets by e-mail, only the steps to reproduce.
What we ask of you.
- Test only systems that TAIA operates: taia.ch and its subdomains, including he.taia.ch and ask.taia.ch. Services run by others (Google Cloud, Stripe, Apple, our DNS provider) are outside this policy; they have their own programmes.
- Go no further than needed to show the problem. Do not read, copy, change or delete data that is not your own; if you meet personal data, stop, do not keep it, and tell us.
- Do not disrupt the service: no denial-of-service, no load tests, no spam, no social engineering of TAIA staff, no physical access.
- Do not use an access key, account or session that is not yours, and do not publish any key or password.
- Give us 90 days from your report before you publish; we will tell you when a fix is live and are happy to agree an earlier date.
What TAIA commits to.
- We confirm receipt within 5 business days and tell you what we found and when a fix is live.
- Research done in good faith within these rules is authorised by TAIA. For such research TAIA will not file a criminal complaint and will not bring civil claims against you. TAIA cannot speak for prosecutors, courts or third parties, and this authorisation does not cover systems TAIA does not operate.
- With your consent we name you here as the reporter once the fix is live. TAIA pays no rewards.
Last updated: 2 November 2026.